What is a reverse proxy and why should I use Nginx in front of my application?

A reverse proxy sits between external clients and your backend application servers (Node.js, Next.js, Python, Go, etc.). It handles SSL/TLS termination, static asset caching, Gzip compression, request rate limiting, DDoS mitigation, and load balancing across multiple server instances. Placing Nginx in front of your application keeps your backend code focused on business logic while offloading connection management, cryptographic overhead, and static file delivery to an ultra-optimized C-based engine.

How do I configure Nginx for Next.js App Router and streaming responses?

Next.js 13+ App Router uses React Server Components (RSC) and HTTP chunked streaming (such as AI chat token generation or suspended UI boundaries). In standard Nginx configs, `proxy_buffering on;` causes Nginx to buffer the entire stream before sending bytes to the client, breaking real-time streaming. The Next.js preset sets `proxy_buffering off;` and `proxy_set_header X-Accel-Buffering "no";` for API and page routes, and aggressively caches immutable hashed files under `/_next/static/` for 1 year.

How does client-side routing (try_files) work for React, Vue, and Vite SPAs?

Single Page Applications (SPAs) use client-side JavaScript routers (like React Router or Vue Router) to render virtual pages without making full page requests to a server. When a user directly visits a deep link like `/dashboard/settings`, the server must serve `/index.html` instead of returning a 404 error. The `try_files $uri $uri/ /index.html;` directive tells Nginx to check if a real file or directory matches the request path, and if not, fallback to serving `index.html` so the JavaScript router can handle the route.

Why is "if" in Nginx location context considered evil ("If is Evil")?

In Nginx, the `if` directive inside a `location` block does not behave like traditional procedural programming languages. Because of how Nginx evaluates configuration phases, using `if` inside a location can cause unexpected side effects, request stalls, directive overrides, and even memory segmentation faults in certain Nginx modules. Nginx documentation strongly recommends using `try_files`, `return`, `map`, or separate dedicated location blocks instead of `if` inside locations.

How do I enable WebSocket proxying in Nginx?

WebSockets initiate over standard HTTP/1.1 and upgrade to a persistent bidirectional TCP connection using the `Upgrade: websocket` and `Connection: Upgrade` headers. Nginx requires an explicit mapping (`map $http_upgrade $connection_upgrade { default upgrade; '' close; }`) in the `http` context, along with `proxy_set_header Upgrade $http_upgrade;`, `proxy_set_header Connection $connection_upgrade;`, and `proxy_http_version 1.1;` inside the proxy location block.

What is HSTS and why should I enable it?

HSTS (HTTP Strict Transport Security) is an HTTP response header (`Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`) that informs web browsers that the site must only be accessed over HTTPS for a specified duration (typically 2 years). HSTS prevents SSL stripping man-in-the-middle (MITM) attacks and cookie hijacking by causing browsers to automatically convert any `http://` URL to `https://` before sending the first network packet.

How does rate limiting work with limit_req_zone in Nginx?

Nginx uses the leaky bucket algorithm for rate limiting. `limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;` allocates a 10-megabyte shared memory zone (storing roughly 160,000 client IP states) and enforces an average arrival rate of 10 requests per second. Adding `burst=20 nodelay;` allows sudden spikes of up to 20 concurrent requests without queue delays, while dropping or returning 429 status for any excess requests beyond the burst capacity.

What is the difference between Nginx and Caddy for reverse proxying?

Nginx is a battle-tested, high-throughput, C-based web server with fine-grained low-level configuration capabilities and widespread enterprise adoption. Caddy is a modern, Go-based web server featuring out-of-the-box automatic Let’s Encrypt HTTPS issuance, HTTP/3 support by default, and an ultra-concise declarative configuration syntax (Caddyfile). Both are excellent choices: Nginx provides unmatched raw performance and ecosystem tuning, while Caddy offers simplicity and zero-maintenance TLS.

DevFlow

Nginx Config Generator

Generate Nginx, Caddy & Apache reverse proxy configs with SSL & presets

Runs in browserNo signup required

Domains / Server Names (`server_name`)

Enter hostnames or domains this server handles (e.g. example.com, api.example.com, localhost).

example.com

www.example.com

Listen Port

IPv6 Support (`listen [::]:...`)

Bind to dual-stack IPv6 addresses

Document Root Directory

Index Files

Upstream Server Clusters (`upstream`)

Define backend server pools for load balancing and proxy targets.

Upstream Name

Balancing Algorithm

Keepalive Connections

Target Servers:

Weight:

Backup

nginx.conf154 lines

# ==============================================================================
# Nginx Server Configuration — Generated for example.com
# Preset: nextjs
# ==============================================================================

upstream nextjs_upstream {
    server 127.0.0.1:3000;
    keepalive 32;
}

# WebSocket Connection Upgrade Map
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# Rate Limiting Zones
limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;
limit_req_status 429;

# HTTP -> HTTPS Redirect Server
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # Let's Encrypt ACME Challenge passthrough
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/certbot;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# Main Application Server
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;
    root /var/www/html;
    index index.html index.htm;

    # SSL/TLS Configuration
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 8.8.8.8 valid=300s;
    resolver_timeout 5s;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    # Performance & Tuning
    server_tokens off;
    client_max_body_size 16M;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;

    # Gzip Compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types text/plain text/css text/javascript application/javascript application/json application/xml application/xml+rss image/svg+xml application/wasm font/woff2;

    # Logging
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log warn;

    # Global Rate Limiting
    limit_req zone=req_limit burst=20 nodelay;

    # Block Hidden Files & Directories (.git, .env, etc.)
    location ~ /\.(?!well-known) {
        deny all;
        access_log off;
        log_not_found off;
    }

    location /_next/static/ {
        proxy_pass http://nextjs_upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        expires 365d;
        add_header Cache-Control "public, max-age=31536000, immutable";
        access_log off;
    }

    location /static/ {
        proxy_pass http://nextjs_upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        expires 30d;
        add_header Cache-Control "public, max-age=2592000";
        access_log off;
    }

    location / {
        proxy_pass http://nextjs_upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 300s;
    }

}

All systems operationalv0.3.0

⌘↵ Run⌘⇧C Copy⌘K Search

Visual reverse proxy config builder supporting Nginx, Caddy, and Apache. Features production-ready presets for Next.js, SPAs, Node APIs, WebSockets, Let’s Encrypt SSL/TLS, rate limiting, and real-time security antipattern linting.

JavaScript is required to use this interactive tool. Please enable JavaScript in your browser, or use our Nginx Config Generator API for programmatic access.

Browse all Web Code tools →

Popular Web Code tools

Browse all 21 Web Code tools →

Nginx Config Generator is also known as: nginx generator, caddyfile generator, reverse proxy config builder, nginx reverse proxy tool, nginx ssl config builder.

How to Nginx Config Generator Online

Select an application preset (Next.js 15 App Router, React/Vite SPA, Node.js API Cluster, Python FastAPI, or Static Website) or start from a custom blank configuration.
Set your primary domain names and aliases in the Server tab (e.g. example.com, api.example.com) and configure your listening ports and IPv6 dual-stack bindings.
Define your upstream server pools and load balancing algorithms (Round Robin, Least Connections, or IP Hash session affinity) with health-checks, weights, and failover backups.
Customize location route rules in the Routes tab: configure proxy_pass targets, try_files SPA client routing, static asset caching with immutable headers, WebSockets, and Server-Sent Events (SSE) streaming.
Enable SSL/TLS termination in the SSL/TLS tab: set Let’s Encrypt Certbot or custom certificate paths, enforce HTTP-to-HTTPS 301 redirects, HTTP/2, HTTP/3 QUIC, HSTS preloading, and OCSP stapling.
Configure performance optimizations in the Speed tab: tune Gzip compression levels and MIME types, define rate-limiting token bucket zones (limit_req_zone), and enable kernel zero-copy sendfile.
Harden your web server in the Security tab: configure X-Frame-Options clickjacking protection, nosniff MIME checking, Content-Security-Policy (CSP), hidden dotfile blocking (.git/.env), and CORS preflight handling.
Switch between Nginx (nginx.conf), Caddyfile, and Apache VirtualHost tabs to preview live generated configs and review real-time diagnostic antipattern warnings before copying or downloading your file.